The related research on privacy-preserving neural network based on MPC mainly includes training and inference. The training part requires to ensure the privacy of training data and privacy of the result model, and the inference part requires to ensure that the data holder cannot explore the knowledge of the model and the model holder cannot have any understanding of the data required to be predicted. Because the training part includes forward propagation and back propagation and the inference part only includes forward part, the content is relatively simple and the related work is also relatively extensive[1]}, [2]}, [3]}, [4]}, [5]}, [6]}, [7]}, [8]}, [9]}, [10]}, [6]}, [12]}, [2]}, [14]}. CryptoNet[10]} is the earliest implementation of privacy-preserving inference based on Homomorphic Encryption, using squares instead of the sigmoid function and mean pooling instead of max pooling. CryptoDL[6]} further improves CryptoNet using low-order polynomials to approximate nonlinear functions. MiniONN[12]} proposes the use of the single instruction, multiple data (SIMD) batch to improve the pre-computed secret sharing protocol and the method of approximating the nonlinear activation function with polynomials. Without changing the trained model, the model is converted into an oblivious form, achieving a privacy-preserving inference. Chameleon[1]} uses a hybrid protocol, which uses GMW[19]} for low-order nonlinear functions, Garbled Circuit for high-order nonlinear functions, Secret Sharing for linear functions to achieve inference, and proposes improvements to vector computation and a new method for multiplication triplets generation, but the selection of a neutral third party is not easy in the actual operation. In a follow-up work, DeepSecure[2]} designs the optimized realization of the components in a neural network based on Garbled Circuit. XONN[14]} also uses Garbled Circuit, but the matrix multiplication is replaced by the free XNOR gate. Particularly, it changes the weights in the neural network from floating point numbers to \(\left\lbrace  { - 1,0,1} \right\rbrace \) . Both of the above maintain the same security guarantee, that is, the parameters of the neural network model are used as privacy, and the composition of the model, the number of layers, and the number of neurons in each layer can be open to the demander.
